VLANs Explained: Design, Trunking and Inter-VLAN Routing

VLANs are one of the first things you configure on a new switch and one of the last things you suspect when something breaks. They are simple in concept: split one physical switch into several logical ones. Yet trunks, native VLANs and inter-VLAN routing hide a handful of details that trip up admins and engineers alike. This guide explains how VLANs work under the hood, how to design them sensibly, and exactly how to configure access ports, 802.1Q trunks, router-on-a-stick and switched virtual interfaces on Cisco IOS.

What a VLAN actually is

A Virtual Local Area Network (VLAN) is a logical broadcast domain created on a switch. Without VLANs, every port on a switch belongs to the same broadcast domain: an ARP request or DHCP discover from one device is flooded to every other port. With VLANs, the switch keeps a separate MAC address table and flooding scope for each VLAN. A broadcast in VLAN 10 never leaves VLAN 10.

The practical effect is that ports in different VLANs behave as though they were on physically separate switches. Two PCs in different VLANs cannot talk to each other directly, even if they are plugged into adjacent ports. To communicate, their traffic must pass through a Layer 3 device, either a router or a Layer 3 switch, which is also where you can apply security policy.

A widely used design convention is one VLAN equals one IP subnet. VLAN 10 might be 10.1.10.0/24, VLAN 20 might be 10.1.20.0/24, and so on. Keeping that mapping one-to-one makes troubleshooting, documentation and access control far simpler. If you need a refresher on carving up address space for each VLAN, see our guide to subnetting and CIDR.

Why VLANs matter

VLANs solve several problems at once, which is why virtually every business network uses them:

• Segmentation and security. Guest Wi-Fi, IP cameras, payment terminals and staff PCs should not share a flat network. VLANs give you boundaries where you can filter traffic with ACLs or a firewall.
• Smaller broadcast domains. Every broadcast must be processed by every host in its domain. Smaller domains mean less noise and contain the impact of problems such as broadcast storms.
• Flexibility. Users can be grouped by function rather than by physical location. Moving a user to a different department becomes a configuration change rather than a cabling job.
• Quality of service. Putting IP phones in a dedicated voice VLAN makes it easy to identify and prioritize voice traffic.
• Operational clarity. A well-planned VLAN scheme tells you at a glance what a device is and what it should be allowed to reach.

Designing a sensible VLAN scheme

Good VLAN design starts on paper, not on the switch. A few decisions made early will save you years of confusion.

Group by function and trust level

Create VLANs based on what devices do and how much you trust them, not on the org chart. A typical small or mid-sized business might use something like this:

Notice the convention of matching the VLAN ID to the third octet of the subnet. It is not required, but it makes it obvious that 10.1.30.15 lives in VLAN 30.

Avoid VLAN 1 for real traffic

VLAN 1 is the default VLAN on Cisco switches. Every port starts there, and many control protocols such as CDP and VTP use it. It cannot be deleted. Best practice is to leave VLAN 1 empty of users and management traffic, move all active ports into purpose-built VLANs, and place unused ports in a dedicated “parking” VLAN while keeping them shut down.

Keep VLANs local where you can

Stretching a VLAN across an entire campus means stretching its broadcast domain and its spanning tree topology along with it. Modern designs generally keep Layer 2 domains small, often confined to an access switch or a wiring closet, and route everywhere else. That limits the blast radius of loops and makes failures easier to isolate.

Be careful with VTP

VLAN Trunking Protocol can synchronize the VLAN database across switches, but a switch with a higher configuration revision number can overwrite VLANs across the whole domain if it is introduced carelessly. Many engineers run VTP in transparent mode, or disable it where supported, and manage VLANs explicitly or through automation instead.

Configuring access ports

An access port belongs to exactly one data VLAN and sends and receives untagged Ethernet frames. End devices such as PCs, printers and cameras connect to access ports and have no idea a VLAN exists. First, create and name the VLANs:

vlan 10
 name STAFF
vlan 20
 name VOICE
vlan 99
 name MGMT
vlan 999
 name NATIVE-UNUSED

Then configure the access port. This example is a desk port with a PC plugged into an IP phone:

interface GigabitEthernet1/0/5
 description Desk 2.14 - PC and phone
 switchport mode access
 switchport access vlan 10
 switchport voice vlan 20
 switchport nonegotiate
 spanning-tree portfast
 spanning-tree bpduguard enable
 no shutdown

Here is what each line does:

• switchport mode access hard-codes the port as an access port so it never forms a trunk.
• switchport access vlan 10 places untagged traffic, the PC behind the phone, into VLAN 10.
• switchport voice vlan 20 tells the phone, typically via CDP or LLDP-MED, to tag its own voice traffic with VLAN 20.
• switchport nonegotiate disables Dynamic Trunking Protocol (DTP) messages on the port.
• spanning-tree portfast lets the port start forwarding immediately instead of waiting through listening and learning, which avoids DHCP timeouts on boot.
• spanning-tree bpduguard enable err-disables the port if a switch is plugged in, protecting the spanning tree topology.

Unused ports should be parked and shut down:

interface range GigabitEthernet1/0/40 - 47
 description UNUSED
 switchport mode access
 switchport access vlan 998
 shutdown

Trunking with 802.1Q

A trunk carries traffic for many VLANs over a single link, typically between switches, or between a switch and a router, firewall, wireless access point or hypervisor. To keep frames from different VLANs apart on that shared link, the sender tags each frame using the IEEE 802.1Q standard.

How the 802.1Q tag works

The switch inserts a 4-byte tag into the Ethernet frame between the source MAC address and the EtherType field. The tag contains:

• TPID (16 bits): set to 0x8100, identifying the frame as 802.1Q tagged.
• PCP (3 bits): the priority code point, used for 802.1p class of service markings.
• DEI (1 bit): drop eligible indicator, formerly called CFI.
• VID (12 bits): the VLAN identifier.

Twelve bits give 4,096 possible values, but 0 and 4095 are reserved, so VLAN IDs 1 to 4094 are usable. The tag also increases the maximum standard frame size from 1,518 to 1,522 bytes. The receiving switch reads the VID, removes the tag and forwards the frame only to ports in that VLAN.

The native VLAN

One VLAN on each trunk is sent untagged: the native VLAN, which defaults to VLAN 1. Any untagged frame that arrives on a trunk is placed into the native VLAN. The native VLAN must match on both ends of the link. If it does not, traffic from one VLAN silently leaks into another, and Cisco switches running CDP will log a native VLAN mismatch message.

Best practice is to set the native VLAN to a dedicated, unused VLAN such as 999 on every trunk. This also mitigates double-tagging VLAN hopping attacks, which rely on an attacker sitting in the native VLAN.

Trunk configuration

interface GigabitEthernet1/0/48
 description Uplink to DIST-SW1 Gi1/0/1
 switchport trunk encapsulation dot1q
 switchport mode trunk
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,30,40,50,99
 switchport nonegotiate
 no shutdown

• switchport trunk encapsulation dot1q is only needed, and only accepted, on platforms that also support the older Cisco ISL encapsulation. Switches that only support 802.1Q, such as most current Catalyst models, do not need it.
• switchport mode trunk forces trunking rather than relying on DTP negotiation.
• switchport trunk allowed vlan restricts the trunk to the VLANs that are actually needed downstream, which limits flooding and spanning tree scope.
• switchport nonegotiate stops DTP frames, preventing an attacker from negotiating a trunk.

A word on DTP

Dynamic Trunking Protocol lets Cisco switches negotiate whether a link should become a trunk. A port in dynamic desirable mode actively tries to form a trunk, while dynamic auto waits to be asked. Two ports in dynamic auto never form a trunk. Negotiation is convenient in a lab, but in production it is safer to set every port explicitly to access or trunk and disable DTP with switchport nonegotiate.

Inter-VLAN routing options

Because each VLAN is its own subnet and broadcast domain, traffic between VLANs needs a Layer 3 hop. Each VLAN needs a default gateway address on a routing device. There are three ways to provide that:

In many small businesses, the “router” in router-on-a-stick is actually the firewall, with a subinterface per VLAN. That design puts security policy directly between VLANs, which is attractive when traffic volumes are modest.

Router-on-a-stick configuration

With router-on-a-stick, the switch port facing the router is a normal 802.1Q trunk, configured as shown above. On the router, the physical interface is enabled without an IP address, and a subinterface is created for each VLAN:

interface GigabitEthernet0/0/1
 description Trunk to ACCESS-SW1 Gi1/0/48
 no ip address
 no shutdown
!
interface GigabitEthernet0/0/1.10
 description STAFF gateway
 encapsulation dot1Q 10
 ip address 10.1.10.1 255.255.255.0
 ip helper-address 10.1.40.10
!
interface GigabitEthernet0/0/1.20
 description VOICE gateway
 encapsulation dot1Q 20
 ip address 10.1.20.1 255.255.255.0
 ip helper-address 10.1.40.10
!
interface GigabitEthernet0/0/1.99
 description MGMT gateway
 encapsulation dot1Q 99
 ip address 10.1.99.1 255.255.255.0
!
interface GigabitEthernet0/0/1.999
 description Native VLAN - no IP
 encapsulation dot1Q 999 native

Key points to remember:

• The subinterface number does not have to match the VLAN ID, but matching them is a strong convention that prevents mistakes.
• encapsulation dot1Q must be configured before an IP address can be applied to the subinterface.
• The native keyword tells the router which VLAN arrives untagged, and it must match the switch’s native VLAN.
• ip helper-address forwards DHCP broadcasts (UDP ports 67 and 68) from the VLAN to a DHCP server in another subnet, here a server in VLAN 40.
• If the physical interface is shut down, every subinterface goes down with it.

Inter-VLAN routing with SVIs on a Layer 3 switch

A switched virtual interface (SVI) is a logical Layer 3 interface for a VLAN on a multilayer switch. The switch routes between SVIs in hardware, so throughput is typically far higher than router-on-a-stick, and no external trunk to a router is needed for traffic between local VLANs.

ip routing
!
interface Vlan10
 description STAFF gateway
 ip address 10.1.10.1 255.255.255.0
 ip helper-address 10.1.40.10
 no shutdown
!
interface Vlan20
 description VOICE gateway
 ip address 10.1.20.1 255.255.255.0
 ip helper-address 10.1.40.10
 no shutdown
!
interface Vlan99
 description MGMT gateway
 ip address 10.1.99.1 255.255.255.0
 no shutdown
!
interface GigabitEthernet1/0/1
 description Routed uplink to FIREWALL
 no switchport
 ip address 10.1.255.2 255.255.255.252
 no shutdown
!
ip route 0.0.0.0 0.0.0.0 10.1.255.1

• ip routing enables IPv4 routing on the switch. Without it, the SVIs exist but the switch will not route between them.
• Each interface VlanX becomes the default gateway for hosts in that VLAN.
• no switchport turns a physical port into a routed port, used here as a point-to-point /30 uplink to the firewall.
• The default route sends everything that is not local towards the firewall. In larger networks you would run a dynamic routing protocol such as OSPF on the uplinks instead.

An SVI only comes up when its VLAN exists and at least one port carrying that VLAN, an access port or a trunk that allows it, is up and in the spanning tree forwarding state. This behavior is called autostate, and it is the most common reason a freshly configured SVI stays down.

Verification and troubleshooting

When users in a VLAN cannot reach their gateway, or a new VLAN does not work across a trunk, work through the path methodically rather than changing things at random. These commands answer the most important questions:

show vlan brief
show interfaces GigabitEthernet1/0/5 switchport
show interfaces trunk
show mac address-table vlan 10
show spanning-tree vlan 10
show ip interface brief
show ip route

Work from the bottom up: physical link, access VLAN, trunk allowed list and native VLAN, spanning tree state, gateway interface, then routing and filtering. A disciplined approach like the one in our network troubleshooting methodology guide will find the fault faster than guessing. The best place to practice all of this is a lab where you can break trunks on purpose; our guide to building a home network lab shows you how to set one up.

Key takeaways

• A VLAN is a separate broadcast domain on a switch; map each VLAN to exactly one IP subnet.
• Design VLANs by function and trust level, keep VLAN 1 empty, and park unused ports in a shut-down VLAN.
• Access ports carry one untagged data VLAN plus an optional voice VLAN; harden them with PortFast, BPDU Guard and switchport nonegotiate.
• 802.1Q trunks insert a 4-byte tag with a 12-bit VLAN ID; usable IDs are 1 to 4094.
• Set a dedicated, matching native VLAN on every trunk and restrict the allowed VLAN list, using add when extending it.
• Router-on-a-stick suits small sites and labs; SVIs on a Layer 3 switch are the norm for higher-throughput networks.
• Inter-VLAN routing opens paths between segments, so filter traffic with ACLs or a firewall deliberately.

A clean VLAN design is one of the highest-value improvements you can make to a growing network. If your switches have grown into a flat network or a tangle of undocumented VLANs, our Small Business Network Setup service can design and deploy a segmented, documented network for you, or you can contact us to talk through your current setup.